@s4yhiitestpoc
LPM Firewall blocks 5 packages in the @s4yhiitestpoc npm scope. 5 have LPM's own review and are listed first.
The postinstall hook performs an automatic transfer of host-identifying data to an external endpoint. That establishes a concrete data exfiltration attack surface even though the inspecte...
OpenSSF Malicious Packages via OSV confirms @s4yhiitestpoc/r3-https@0.0.0-stage as malicious (MAL-2026-17765): Malicious code in @s4yhiitestpoc/r3-https (npm)
The lifecycle hook actively transmits environment fingerprint data to an external endpoint during installation. Its proof-of-concept framing does not establish user consent for that trans...
The active install hook performs unsolicited collection and external transmission of host and registry context. This is concrete data exfiltration, so the package should be blocked.
The install-time DNS beacon is an automatic external signal that reveals package installation. The lifecycle declaration and lookup are both confirmed in source.